Tracking the World's Dumbest Cyber Mercenaries
summary
Detailed forensic trail of Dark Caracal shows phishing-delivered Banduk RAT and Palace backdoored Android apps stealing photos, SMS, GPS and plaintext of encrypted chats; command servers run on exposed XAMPP instances that leak XAMPP directory indexes allowing download of artifacts and automated Derbuster enumeration; researchers collect 81 GB of data and sinkhole an unregistered domain observing 700–800 machines weekdays with geolocated infections tied to downtown Beirut (Building 3 floor 6, GDGS) and wider global targets.
AI-written summary · about
chapters (10)
- 0:00Introduction by MC
- 1:51Story of Idin Petrus
- 6:15Operation Manul malware
- 9:07Dark Caracal mobile spyware
- 13:02Geolocating the attackers
- 16:55Banduk resurfaces in 2022
- 19:44Prince Ali’s failed career
- 21:50Effectiveness of dumb mercenaries
- 24:17Future of spyware threats
- 25:01Q&A and closing
related talks
56mCybersecurity & Privacy From The Global Lens
47mDetecting and analyzing files-less malware
49mThe State Of Malware From The Eye Of The Tiger
17mRadRAT: An all-in-one toolkit for complex espionage ops
42mWho Let the Dogs Out? When PUPs Become BlackCat's Best Friend
26mThe Secret Life of Sandworms
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
30mReversing Mobile Malware